Debian Linux vulnerabilities

CVE-2022-48971 [MEDIUM] CVE-2022-48971: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ... In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix not cleanup led when bt_init fails bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access i

CVE-2022-49005 [MEDIUM] CVE-2022-49005: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: ... In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fix bounds check for _sx controls For _sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in snd_soc_put_volsw_sx() needs to just check against the maximum value. Scope: local bookworm: resol

CVE-2022-49011 [MEDIUM] CVE-2022-49011: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (cor... In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). So call it after using to avoid refcount l

CVE-2022-48992 [MEDIUM] CVE-2022-48992: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-p... In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: Add NULL check in BE reparenting Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test. Scope: local bookworm: resolved (fixed in 6.1.4-1) bullseye: resolved (fixed in 5.10.162-1) forky: resolved (fixed in 6.1.4-1)

CVE-2021-47003 [MEDIUM] CVE-2021-47003: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ... In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix potential null dereference on pointer status There are calls to idxd_cmd_exec that pass a null status pointer however a recent commit has added an assignment to *status that can end up with a null pointer dereference. The function expects a null status pointer sometimes as there

CVE-2021-47022 [MEDIUM] CVE-2021-47022: linux - In the Linux kernel, the following vulnerability has been resolved: mt76: mt761... In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: fix memleak when mt7615_unregister_device() mt7615_tx_token_put() should get call before mt76_free_pending_txwi(). Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolved (fixed in 5.10.38-1) sid: resolved (fixed in 5.10.38-1) trixie

CVE-2024-35879 [MEDIUM] CVE-2024-35879: linux - In the Linux kernel, the following vulnerability has been resolved: of: dynamic... In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals In the following sequence: 1) of_platform_depopulate() 2) of_overlay_remove() During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but __of_changeset_entry_destroy() can

CVE-2024-27406 [MEDIUM] CVE-2024-27406: linux - In the Linux kernel, the following vulnerability has been resolved: lib/Kconfig... In the Linux kernel, the following vulnerability has been resolved: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU Trying to run the iov_iter unit test on a nommu system such as the qemu kc705-nommu emulation results in a crash. KTAP version 1 # Subtest: iov_iter # module: kunit_iov_iter 1..9 BUG: failure at mm/nommu.c:318/vmap()! Kernel panic - not syncing: BUG! T

CVE-2024-47681 [MEDIUM] CVE-2024-47681: linux - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76:... In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he Fix the NULL pointer dereference in mt7996_mcu_sta_bfer_he routine adding an sta interface to the mt7996 driver. Found by code review. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.11.2-1) sid

CVE-2024-46767 [MEDIUM] CVE-2024-46767: linux - In the Linux kernel, the following vulnerability has been resolved: net: phy: F... In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing of_node_put() for leds The call of of_get_child_by_name() will cause refcount incremented for leds, if it succeeds, it should call of_node_put() to decrease it, fix it. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 6.10.11-1) sid: resolved (fixed

CVE-2023-52674 [MEDIUM] CVE-2023-52674: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: scarl... In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside scarlett2_mixer_values[]. Scope: local bookworm: resolved (fixed in 6.1.76-1) bullseye: open forky: resolved

CVE-2023-52850 [MEDIUM] CVE-2023-52850: linux - In the Linux kernel, the following vulnerability has been resolved: media: hant... In the Linux kernel, the following vulnerability has been resolved: media: hantro: Check whether reset op is defined before use The i.MX8MM/N/P does not define the .reset op since reset of the VPU is done by genpd. Check whether the .reset op is defined before calling it to avoid NULL pointer dereference. Note that the Fixes tag is set to the commit which removed th

CVE-2023-52744 [MEDIUM] CVE-2023-52744: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma:... In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix potential NULL-ptr-dereference in_dev_get() can return NULL which will cause a failure once idev is dereferenced in in_dev_for_each_ifa_rtnl(). This patch adds a check for NULL value in idev beforehand. Found by Linux Verification Center (linuxtesting.org) with SVACE. Scope: local bo

CVE-2022-49019 [MEDIUM] CVE-2022-49019: linux - In the Linux kernel, the following vulnerability has been resolved: net: ethern... In the Linux kernel, the following vulnerability has been resolved: net: ethernet: nixge: fix NULL dereference In function nixge_hw_dma_bd_release() dereference of NULL pointer priv->rx_bd_v is possible for the case of its allocation failure in nixge_hw_dma_bd_init(). Move for() loop with priv->rx_bd_v dereference under the check for its validity. Found by Linux Ver

CVE-2022-48995 [MEDIUM] CVE-2022-48995: linux - In the Linux kernel, the following vulnerability has been resolved: Input: rayd... In the Linux kernel, the following vulnerability has been resolved: Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() There is a kmemleak when test the raydium_i2c_ts with bpf mock device: unreferenced object 0xffff88812d3675a0 (size 8): comm "python3", pid 349, jiffies 4294741067 (age 95.695s) hex dump (first 8 bytes): 11 0e 10 c0 01 00 04 00 ........ b

CVE-2021-47289 [MEDIUM] CVE-2021-47289: linux - In the Linux kernel, the following vulnerability has been resolved: ACPI: fix N... In the Linux kernel, the following vulnerability has been resolved: ACPI: fix NULL pointer dereference Commit 71f642833284 ("ACPI: utils: Fix reference counting in for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer that was possibly NULL. That fails miserably, because that helper inline function is not set up to handle that case. Just make acpi_

CVE-2021-47120 [MEDIUM] CVE-2021-47120: linux - In the Linux kernel, the following vulnerability has been resolved: HID: magicm... In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: fix NULL-deref on disconnect Commit 9d7b18668956 ("HID: magicmouse: add support for Apple Magic Trackpad 2") added a sanity check for an Apple trackpad but returned success instead of -ENODEV when the check failed. This means that the remove callback will dereference the never-initi

CVE-2021-47538 [MEDIUM] CVE-2021-47538: linux - In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ... In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer() Need to call rxrpc_put_local() for peer candidate before kfree() as it holds a ref to rxrpc_local. [DH: v2: Changed to abstract the peer freeing code out into a function] Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed

CVE-2021-47579 [MEDIUM] CVE-2021-47579: linux - In the Linux kernel, the following vulnerability has been resolved: ovl: fix wa... In the Linux kernel, the following vulnerability has been resolved: ovl: fix warning in ovl_create_real() Syzbot triggered the following warning in ovl_workdir_create() -> ovl_create_real(): if (!err && WARN_ON(!newdentry->d_inode)) { The reason is that the cgroup2 filesystem returns from mkdir without instantiating the new dentry. Weird filesystems such as this wil

CVE-2024-56578 [MEDIUM] CVE-2024-56578: linux - In the Linux kernel, the following vulnerability has been resolved: media: imx-... In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Set video drvdata before register video device The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() file ops, and led to oops. Scope: local bookworm: resolved (fixed in 6.1.123-1) bullseye: resolved forky: res